The Travel Card is a card offered by Matkahuolto that can be used to store Matkahuolto’s tickets products, such as season and multiple tickets. A single ticket is a ticket available at Matkahuolto outlets, agents, travel agencies or Matkahuolto’s online sites.

Matkahuolto is the controller of the personal data that Travel Card users like yourself disclose to us in order to buy and use the ticket products and single tickets available for downloading to the Travel Card. As the controller, Matkahuolto is responsible for all personal data provided by you and the processing of this data. As data protection is about trust, the protection of your privacy and personal data is of great importance to Matkahuolto. This is why Matkahuolto only collects personal data to the extent necessary to be able to offer you first-rate service. A more detailed description of the ways in which your personal data is processed and the purposes of such processing is provided in this privacy statement.

The Travel Card holder register contains personal data of Travel Card users (data subjects) which Matkahuolto needs to process in order to be able offer services to the data subjects.

1. Subsidised School Trip Ticket for upper secondary students

The Subsidised School Trip Ticket for upper secondary students is a ticket product offered by Matkahuolto and subsidised by the Social Insurance Institution of Finland Kela for those full-time students whose studies meet the criteria specified in the Subsidised School Trips Act (48/1997).

Matkahuolto processes the following personal data of upper secondary students who use the Subsidised School Trip Ticket:

Information identifying the data subject: personal identity number, full name, telephone number, e-mail address and customer category as well as street address if it is necessary to verify the data subject’s right to buy the ticket.

Information concerning the data subject’s right to buy the ticket and its verification (purchase certificate and transaction data on receipt of the purchase certificate).

Basic Travel Card information: Travel Card no.; purchase counter based on the topping-up limitations imposed by the Social Insurance Institution of Finland Kela; Travel Card status information (card in use, blocked, lost or found). The data subject’s Travel Card number is also stored on his/her Travel Card.

Other information concerning the Travel Card, such as information on the issue of the Travel Card to the data subject; number of topping-up transactions including date and site; ticket product; validity of the right to travel and information on any refunds. The data subject’s ticket product and the period of validity of the right to travel on the ticket are also stored on his/her Travel Card.

Information on the use of the Travel Card: Date and time when the Travel Card is read; the means of transport on which the card is read; ID no. of the reader device; and information on the bus operator and service.

Any objection to or permission for direct marketing filed by the data subject.

Information on any changes to the foregoing data.

2. Personal Travel Cards subsidised by municipalities or cities

Personal Travel Cards subsidised by municipalities or cities mean city or regional ticket products downloaded onto personal Travel Cards (season or multiple cards), ticket products intended for comprehensive school students and ticket products intended for war veterans. The issuance of these ticket products is based on the data subject’s residence within the limits of a given municipality or city or region. A further criterion for the issuance of the tickets for comprehensive school students and war veterans is their personal status (student or war veteran).

Matkahuolto processes the following personal data of holders of personal Travel Cards subsidised by municipalities or cities:

Information identifying the data subject: full name, telephone number, e-mail address and customer category as well as street address if it is necessary to verify the data subject’s right to buy the ticket. In the case of comprehensive school students, Matkahuolto also processes personal identity numbers.

Information concerning the data subject’s right to buy the ticket and its verification (purchase certificate and transaction data on receipt of the purchase certificate).

Basic Travel Card information: Travel Card no.; purchase counter based on the topping-up limitations imposed by the Social Insurance Institution of Finland Kela; Travel Card status information (card in use, blocked, lost or found). The data subject’s Travel Card number is also stored on his/her Travel Card.

Other information concerning the Travel Card, such as information on the issue of the Travel Card to the data subject; number of topping-up transactions including date and site; ticket product; validity of the right to travel and information on any refunds. The data subject’s ticket product and the period of validity of the right to travel on the ticket are also stored on his/her Travel Card.

Information on the use of the Travel Card: Date and time when the Travel Card is read; the means of transport on which the card is read; ID no. of the reader device; and information on the bus operator and service.

Any objection to or permission for direct marketing filed by the data subject.

Information on any changes to the foregoing data.

3. Ticket products subsidised by the Finnish Defence Forces or the Centre for Non-Military Service

Ticket products subsidised by the Finnish Defence Forces or the Centre for Non-Military Service mean ticket products downloaded to the Travel Cards of conscripts and those completing non-military service (season or multiple card), the issuance of which is based on the data subject’s personal status (conscript or person completing non-military service).

Matkahuolto processes the following personal data of holders of Travel Cards issued to conscripts and those completing non-military service:

Information identifying the data subject: full name, telephone number, e-mail address and customer category as well as street address if it is necessary to verify the data subject’s right to buy the ticket. With regard to conscripts, the data processed by Matkahuolto also includes the name of the troop unit. With regard to those completing non-military service, the data includes the personal identity number.

Information concerning the data subject’s right to buy the ticket and its verification (purchase certificate and transaction data on receipt of the purchase certificate).

Basic Travel Card information: Travel Card no.; purchase counter based on the topping-up limitations imposed by the Social Insurance Institution of Finland Kela; Travel Card status information (card in use, blocked, lost or found). The data subject’s Travel Card number is also stored on his/her Travel Card.

Other information concerning the Travel Card, such as information on the issue of the Travel Card to the data subject; number of topping-up transactions including date and site; ticket product; validity of the right to travel and information on any refunds. The data subject’s ticket product and the period of validity of the right to travel on the ticket are also stored on his/her Travel Card.

Information on the use of the Travel Card: Date and time when the Travel Card is read; the means of transport on which the card is read; ID no. of the reader device; and information on the bus operator and service.

Any objection to or permission for direct marketing filed by the data subject.

Information on any changes to the foregoing data.

4. Employee Ticket products

An Employee Ticket means a subsidised ticket product (season or multiple card) offered by an employer based on the data subject’s employment with the company involved.

Matkahuolto processes the following personal data of holders of employee ticket products:

Information identifying the data subject: personal identity number, full name, telephone number, e-mail address and customer category as well as street address if it is necessary to verify the data subject’s right to buy the ticket. Additionally, Matkahuolto stores information on the workplace of the person entitled to such a work-related benefit.

Information concerning the data subject’s right to buy the ticket and its verification (purchase certificate and transaction data on receipt of the purchase certificate).

Basic Travel Card information: Travel Card no.; purchase counter based on the topping-up limitations imposed by the Social Insurance Institution of Finland Kela; Travel Card status information (card in use, blocked, lost or found). The data subject’s Travel Card number is also stored on his/her Travel Card.

Other information concerning the Travel Card, such as information on the issue of the Travel Card to the data subject; number of topping-up transactions including date and site; ticket product; validity of the right to travel and information on any refunds. The data subject’s ticket product and the period of validity of the right to travel on the ticket are also stored on his/her Travel Card.

Information on the use of the Travel Card: Date and time when the Travel Card is read; the means of transport on which the card is read; ID no. of the reader device; and information on the bus operator and service.

Any objection to or permission for direct marketing filed by the data subject.

The eBus Ticket register contains personal data of those who buy single tickets in Matkahuolto’s online service (data subjects) that they have disclosed to Matkahuolto for the purpose of verifying their right to travel and delivering the receipt by e-mail.

Matkahuolto processes the personal data of Travel Card holders and single-ticket passengers mainly for the purpose of offering and providing travel-related products and services and managing customer relationships. Additionally, Matkahuolto may process personal data for the purpose of conducting customer analyses, such as customer satisfaction surveys, and for direct marketing purposes to the extent permitted by law provided that the data subject has not forbidden the use of his/her personal data for direct marketing purposes.

The processing of data subjects’ identifying information is necessary to verify the right to buy the personal Travel Card and complete transactions. For example, under section 12.2 of the Subsidised School Trip Act, the data subject is required to disclose his/her personal identity number to the seller when buying a ticket eligible for school trip subsidies.

The identifying information and personal identity numbers are used for the following purposes:

Verification of the right to buy the Travel Card;

Blocking of a lost card and transfer of the remaining travel right to a new card;

Identification of the owner of a lost and found card;

Verification of usage transactions;

Investigation of errors.

As far single tickets are concerned, processing of identifying information is necessary in order to verify the right to travel and deliver the receipt by e-mail.

The legal basis for processing personal data is either compliance with the agreement between Matkahuolto and the data subject, Matkahuolto’s legitimate interest or the data subject’s consent given to Matkahuolto. Matkahuolto needs to process your personal data to be able to fulfil the agreement made with you. For instance, if you buy subsidised ticket products, Matkahuolto needs to process your personal data in order to be able to invoice the party paying the subsidy. Processing based on Matkahuolto’s legitimate interest refers, among other things, to situations in which Matkahuolto processes your data for administrative purposes or in order to prevent or investigate misuse.

In some case, the processing of personal data is based on Matkahuolto’s statutory obligation (cf. School Trips Subsidy Act 48/1997 under which the data subject is required to disclose his or her personal identity number to the seller of the ticket eligible for such subsidy), or the fulfilment of a contract that the data subject is party to, or Matkahuolto’s legitimate interest especially when it is related to marketing.

The data subject’s obligation to disclose personal data as provided in this privacy statement is partly a statutory obligation and partly a precondition for the conclusion of an agreement between the data subject and Matkahuolto. For example, under section 12.1 of the Subsidised School Trip Act, the data subject is required to disclose his/her personal identity number to the seller when buying a ticket eligible for school trip subsidies. If the data subject refuses to disclose his or her personal data to Matkahuolto as explained in this privacy statement, Matkahuolto is unable to verify the data subject’s right to buy the ticket and cannot therefore issue the Travel Card to the data subject.

The foregoing does not apply to the data subject’s consent to receive direct marketing material.

Matkahuolto collects information from the data subject him- or herself when issuing Travel Cards and at other times when the data subjects have any transactions with Matkahuolto either at its service outlets or its agents’ outlets or any online service.

Data on the use of the card is collected whenever the card is used. Matkahuolto uses a technical interface to collect data on the use of the Travel Card from bus operators on whose means of transport the card is used.

Additionally, Matkahuolto collects information on topping up transactions from parties at whose sites the Travel Card can be topped up.

Matkahuolto collects information on single tickets from the data subjects themselves.

Matkahuolto may transfer data subjects’ personal data to third parties for the purposes described in this privacy statement as explained below. When doing so, Matkahuolto ensures, through contractual arrangements, that the processor of personal data processes that data exclusively in accordance with the instructions issued by Matkahuolto and exclusively for the purposes indicated in this privacy statement. Also, Matkahuolto ensures that access to personal data is limited to persons who need to access it for work-related reasons.

Processors of personal data: Matkahuolto may transfer personal data to processors for the purpose of providing services or completing tasks they have been assigned to carry out, such as IT system maintenance or other data processing tasks.

Bus operators: Matkahuolto transfers personal data to a limited extent to bus operators for the purpose of providing travel services. The card readers used by bus operators make it possible to elicit the following information from the cards: Travel Card no., ticket product and the period of validity of the right to travel.

No personal data will be transferred to outside the European Union or the European Economic Area.

1. Subsidised School Trip Ticket for upper secondary students

Matkahuolto regularly discloses information to the Social Insurance Institution of Finland Kela which grants school trip subsidies and credits the amount to Matkahuolto on a monthly basis.

The disclosure of information to Kela is necessary to verify the invoicing basis to allow Matkahuolto to invoice Kela and Kela to check the correctness of such invoicing. Provisions on the disclosure of information are set out in section 1 of the Decree on School Trip Subsidies for General Upper Secondary and Vocational School Students (425/2004).

The information elicited from the Travel Card is encrypted and transmitted to Kela over a secure technical interface.

Information regularly disclosed to Kela:

Identifying information of the data subject;

Information on the use of the Travel Card when disclosure of this information is necessary to verify invoicing by Matkahuolto;

Travel Card topping-up transactions and refunds.

2. Personal Travel Cards subsidised by municipalities or cities

Matkahuolto regularly discloses information to the municipality or city that grants the subsidy and credits the amounts to Matkahuolto on a monthly basis.

The disclosure of information to the municipality or city is necessary to verify the invoicing basis to allow Matkahuolto to invoice the party granting the subsidy and such a party to check the correctness of such invoicing.

Matkahuolto discloses said information to the municipality or city upon request if such disclosure is necessary to make it possible to verify the correctness of Matkahuolto’s invoicing.

Information regularly disclosed to municipalities or cities:

Identifying information of the data subject;

Information on the use of the Travel Card when disclosure of this information is necessary to verify invoicing by Matkahuolto;

Travel Card topping-up transactions and refunds.

3. Ticket products subsidised by the Finnish Defence Forces or the Centre for Non-Military Service

Matkahuolto regularly discloses information to the Finnish Defence Forces or the Centre for Non-Military Service which pays the cost of the trip under section 103 of the Conscription Act (1438/2007) or section 52 of the Non-Military Service Act (1446/2007) and credits the price of the tickets used to Matkahuolto on a monthly basis.

The disclosure of information to the party paying the cost of travel is necessary to verify the invoicing basis to allow Matkahuolto to invoice such a party and the party to check the correctness of such invoicing.

The information elicited from the Travel Card is encrypted and transmitted to the payer over a secure technical interface or in hardcopy format.

Information regularly disclosed to the Finnish Defence Forces or the Centre for Non-Military Service:

Identifying information of the data subject;

Information on the use of the Travel Card when disclosure of this information is necessary to verify invoicing by Matkahuolto;

The register data is saved in a database that may only be accessed by specifically designated controller’s staff members who need to access such data for work-related reasons, have received adequate training and who are bound by a statutory or contract-based non-disclosure obligation.

The machine-readable service is located in a protected and locked computer room accessible only by technical personnel with access badges. The servers are firewall-protected.

Access to the servers and applications is limited to the controller’s local area network (LAN) and authorised personnel within the LAN holding the necessary user IDs and passwords.

The retention period of the data is determined by the type of data involved and its intended purpose. Matkahuolto or a processor of personal data who carries out processing of such data on behalf of Matkahuolto in connection with the use of Travel Cards retains the personal data of data subjects in accordance with applicable legislation for only as long as the retention of data is necessary to achieve the purpose of the processing of personal data.

In some cases, the retention period of personal data is also determined by the terms and conditions of the agreement made with the subsidising party or by legislation binding on Matkahuolto. For instance, Matkahuolto is obligated to retain information contained in accounting material for the period of time specified in accounting laws (up to 10 years).

As far as single tickets are concerned, the data subject’s name in retained and receipts stored in the system for the period of time required under the Accounting Act. The data subject’s e-mail address is always retained in the system for the duration of the preceding financial year.

When Matkahuolto no longer needs the personal data for the original purposes, the data is erased from Matkahuolto’s and processors’ IT systems and other files or irrevocably anonymised. When Matkahuolto no longer needs the personal data for the original purposes, the data is erased from Matkahuolto’s and processors’ IT systems and other files or irrevocably anonymised.

The EU General Data Protection Regulation guarantees data subjects a number of rights that they can exercise to determine how their personal data is processed.

Right of access: The data subject has the right to receive a confirmation from Matkahuolto as to whether Matkahuolto processes his or her personal data and to access such data. Matkahuolto may request the data subject to formulate his or her request in more detail regarding the procedure for the delivery of the data, etc.

Right to correct personal data: The data subject has the right to correct any errors in the personal data processed by Matkahuolto or complete any incomplete data. When requesting a correction, the data subject needs to be aware that all information cannot be changed retroactively by such request. For example, the contents of the decisions concerning the data subject’s benefits cannot be amended. Specific appeal procedures exist for such decisions as explained in each individual decision.

Right to be forgotten: If there is no longer any legal basis for the processing of personal data or a statutory or contractual provision obligating Matkahuolto to retain personal data ceases to apply, the data subject has the right to demand that Matkahuolto erase his or her personal data and Matkahuolto is required to comply with the request.

Limitation of processing: In certain cases stipulated by law, the data subject may have the right to demand that Matkahuolto limit the processing of his or her personal data.

Right to transfer personal data: Subject to certain statutory provisions, the data subject may have the right to receive from Matkahuolto the personal data concerning him or her in Matkahuolto’s possession in a structured, commonly used and machine-readable format and have the right to transmit that data to another controller without hindrance from Matkahuolto.

Direct marketing and the right to forbid the processing of personal data for direct marketing purposes: The data subject has the right to forbid the processing of his or her personal data for direct marketing purposes. If the data subject has given his or her consent to receiving direct marketing material from Matkahuolto, he or she may cancel such consent at any time.

The data subject may check and correct his or her personal data using the electronic services provided by Matkahuolto, such as the mobile application, or by contacting Matkahuolto’s Customer Service Centre mentioned in section 1 of this privacy statement. Any requests for the erasure, transfer or limitation of the use of the personal data or objection to direct marketing must be submitted to Matkahuolto’s Customer Service Centre.

Matkahuolto will take prompt action in response to the data subject’s request and will provide the data subject with information on the exercise of rights normally within one month of receipt of the request.

Additionally, the data subject has the right to lodge a complaint concerning the processing of personal by Matkahuolto with the data protection authority. Any complaint must be filed with the competent authority, in Finland with the Data Protection Ombudsman, in accordance with the instructions provided by the same. Address of the Data Protection Ombudsman’ website: http://www.tietosuoja.fi.

Matkahuolto reserves the right to update and revise this privacy statement. Unless otherwise provided by law, Matkahuolto may not necessarily notify the data subject of such changes personally, and Matkahuolto therefore urges data subjects to check this private statement from time to time for any changes.